Revup Manual, as shipped in the download
Revup — User Manual
Review requests on your own server — every customer who rates is shown your review link. Version 3.1.4 [src: app/controllers/api.php:21].
About this manual
Every statement here was written by reading Revup's own source, and each one carries the file it came from in a bracketed src marker. Paths are relative to the folder this docs directory sits in. If a sentence disagrees with the application, the application is right and this manual has a bug — the markers exist so you can check rather than take our word for it.
Nothing is described that the code does not do. Where something is deliberately limited, that is said plainly rather than left out.
What Revup does
A customer gets a one-tap rating link. Every customer who rates is then shown your public review page, whatever the rating [src: app/src/Revup.php:74]. Customers who rate below your threshold are also offered a private message to you, on the same page and below the review link — never instead of it [src: app/src/Revup.php:60].
The default threshold is 4, so one to three stars are also offered the private message [src: app/src/Database.php:231]. The threshold is a setting, clamped to 1–5; "Do not offer a private message" (1) switches the offer off [src: app/views/settings.php:21].
Why every customer sees the review link
Google's policy for Maps reviews lists "Discourage or prohibit negative reviews, or selectively solicit positive reviews from customers" among prohibited practices (support.google.com/contributionpolicy/answer/7400114, read 2026-09-24). Revup versions before 3.1.4 showed the review link only to ratings at or above the threshold — the practice commonly called review gating. Since 3.1.4 no rating decides whether the link is shown [src: app/src/Revup.php:50].
The dashboard counts who opened your review page from the rating page — the link goes through Revup once, which records it and fires the rating.public webhook — and who wrote to you privately [src: app/controllers/app.php:616].
What this manual will not do is tell you what the law in your jurisdiction requires, or what any other platform's terms say. Read the terms of whichever platform you link to.
Requests and links
Each request carries a token of 40 hexadecimal characters from a cryptographic source, uniquely indexed [src: app/src/Revup.php:99].
A link is single-use, and the rule is enforced in the database rather than in application logic. The update only lands where the rating is still null, and the call reports whether it actually consumed the token [src: app/src/Revup.php:115].
That is the same shape as an oversell guard: two taps on the same link cannot both record a rating, however they race.
The public rating page
It shows a first name and nothing more. The source is explicit that the public rating page never shows more personal information than that [src: app/src/Revup.php:30], and an empty name becomes "there" rather than a blank [src: app/src/Revup.php:34].
The page is rate-limited per address — sixty hits in ten minutes by default — with old rows pruned as it goes [src: app/src/Revup.php:343].
Message templates
Templates substitute {name}, {business} and {link} [src: app/src/Revup.php:20].
Values are inserted raw, deliberately: the text goes into an email or SMS body rather than into HTML, so escaping it would put backslashes and entities in front of your customers. Previews rendered in the browser are escaped by the view instead [src: app/src/Revup.php:17].
If you paste HTML into a template, understand which of those two paths it is taking.
Importing contacts
CSV import is capped at 5,000 rows [src: app/src/Revup.php:242], and every write clips each field to its column width [src: app/src/Revup.php:137].
Users and roles
Three roles [src: app/controllers/v3.php:25]. The source names what stays with the owner, and the reason is a good one: deleting anything is reserved, because feedback and ratings are the record the reports are built from [src: app/controllers/v3.php:23].
| Permission | viewer | member | admin |
|---|---|---|---|
.view permissions | yes | yes | yes |
audit.view | yes | yes | yes |
contact.edit | — | yes | yes |
request.create / request.send | — | yes | yes |
batch.run | — | yes | yes |
feedback.handle | — | yes | yes |
| everything else, including deletion and the private-message threshold | — | — | yes |
⚠️ The audit trail is readable by a viewer
Revup's viewer role is granted *.view — a wildcard rather than a list [src: app/controllers/v3.php:28]. Because the audit permission is named audit.view, the wildcard matches it, so a viewer can read the audit trail. This has been raised against the product.
Backups follow the model
Revup's database backup downloads are permission-gated, requiring the settings permission [src: app/controllers/api.php:223]. A viewer cannot download the database.
The API and agent access
The instructions state the boundary clearly, and it is the right one: an agent cannot change the threshold or the review URL — those stay with the owner [src: app/controllers/mcp.php:63].
create_request writes — it queues a request for a customer [src: app/controllers/mcp.php:63]. Request status is queued, pending, sent or failed [src: app/controllers/mcp.php:62].
An automation can therefore ask more people for reviews, and cannot change the rating page your customers see.
What Revup does not do
It does not integrate with Google or Yelp. The rating page links to a review URL you supply; there is no platform API.
It does not read any platform's terms for you. It shows every rater your review link; check the terms of the platform you link to.
It does not suppress a review anybody has already written. The rating page collects a rating through your own link; it has no reach into a public platform.
It does not let an agent move the threshold [src: app/controllers/mcp.php:63].
It does not let a rating be recorded twice [src: app/src/Revup.php:115], and it does not delete feedback for anyone below an administrator [src: app/controllers/v3.php:23].
← Back to Revup · Quickstart · API · Test run